Under the DPDP Act, a Data Principal can ask for a summary of the personal data you hold and how you've processed and shared it. Handling these access requests well — accurately, on time, without over-sharing — is a core operational capability.
What they can ask for
A summary of their personal data, your processing activities on it, and the identities of fiduciaries/processors you've shared it with (see data-principal rights).
Step by step
- Log and acknowledge the request through your channel.
- Verify identity proportionately — enough to be sure, without collecting excess (see identity verification).
- Find the data across systems using your data map.
- Compile a clear summary — don't dump raw databases, and don't expose others' data.
- Respond within time and record what you provided.
- Handle follow-ups (correction, erasure) through the right workflow.
Common pitfalls
- Over-sharing — including third parties' data in the response
- Weak or excessive identity checks
- Missing data held in shadow systems
- No record of what you disclosed
How DPDP Bridge helps
DPDP Bridge gives you a DSAR workflow — intake, identity checks, data discovery and an auditable response — so access requests are fast and defensible. Take the free assessment to see exactly where you stand and what to do next.
This article is general information about the DPDP Act and is not legal advice. For guidance specific to your organisation, take the free assessment or speak to our team.